Senior Detection & Automation Security Engineer (AI)

Zoox; Foster City (CA); On-site; USD 190,000 - 228,000; Full time

Benefits offered by this job

Paid time off

Health insurance

Long-term disability insurance

Stock options / RSUs

Life insurance

Job summary

Zoox is seeking a Senior Information Security Engineer in Foster City, CA to shape security operations through engineering. You’ll build robust detection logic, automate workflows with SOAR, and integrate LLMs to improve incident response and triage.

If you enjoy Python, Linux, AWS, and treating security as code, this is your role. You will design detection logic, map to MITRE ATT&CK, and continuously tune alerts while guiding incident response across AWS and on‑prem environments.

Qualifications

• 8+ years in Information Security, Security Operations, or DevSecOps roles.
• Hands-on with SIEM tools like Splunk or ElasticSIEM for detection creation.
• Strong Python development and automation via APIs.
• Experience building automated playbooks in modern SOAR platforms.
• Practical experience with LLM APIs for security log analysis and triage.
• Solid understanding of AWS security services (GuardDuty, CloudTrail, IAM, VPC Flow Logs).

Responsibilities

• Design, build, test, and maintain detection logic within our SIEM platform.
• Map detections to MITRE ATT&CK for comprehensive visibility.
• Tune alerts to minimize false positives and alert fatigue.
• Architect automated playbooks in SOAR platforms to reduce MTTR.
• Develop Python tools and integrations using REST APIs to connect security tools.
• Apply LLMs to analyze, summarize and contextualize incoming alerts.
• Lead incident response guidance and secure workloads across AWS and on-prem environments.

Skills

Python

Splunk/ElasticSIEM

SOAR automation

LLM integration

AWS security

Incident response

Threat hunting

MITRE ATT&CK

Tools

Terraform

Job description

Zoox is seeking a Senior Information Security Engineer in Foster City, CA to shape security operations through engineering. You’ll build robust detection logic, automate workflows with SOAR, and integrate LLMs to improve incident response and triage.

If you enjoy Python, Linux, AWS, and treating security as code, this is your role. You will design detection logic, map to MITRE ATT&CK, and continuously tune alerts while guiding incident response across AWS and on‑prem environments.